ffi M4.B helpers: objcPropertyKind + ARC runtime decls + xfail tests

Three pieces, no behavior change yet:

1. `ObjcPropertyKind` enum (strong/weak/copy/assign) + `objcPropertyKind`
   helper in lower.zig. Reads `field.property_modifiers`, applies the
   default rule (`*<ObjC-class>` → strong; primitives → assign), and
   emits loud diagnostics for the silent-error budget:
   - unknown modifier name (typo) → "expected one of: strong, weak, copy, ..."
   - conflicting modifiers (e.g. `strong,weak`) → "mutually exclusive"
   - `weak` on non-object slot → "requires a pointer-to-Obj-C-class type"
   - `copy` on non-object slot → same
   - `strong` (default or explicit) on `*void` → "ambiguous: specify
     #property(strong|weak|copy|assign) explicitly"
   Called from `emitObjcDefinedClassPropertyImps` for validation; the
   returned kind isn't wired into setter/getter/dealloc yet — that's
   the next three commits.

2. `ensureArcRuntimeDecls` lazily declares libobjc's ARC helpers:
   objc_retain, objc_release, objc_storeWeak, objc_loadWeakRetained,
   objc_initWeak, objc_destroyWeak. Uses the existing
   `ensureCRuntimeDecl` pattern; idempotent.

3. Fix existing NSObject method names in std/objc.sx — `isEqual_`,
   `isKindOfClass_`, `respondsToSelector_` had trailing underscores
   that the selector mangling turned into double-colon selectors
   (`isEqual::`). Removed the trailing underscore so the selectors
   come out as `isEqual:`, `isKindOfClass:`, `respondsToSelector:`
   as Apple's runtime expects.

4. Two xfail regression tests:
   - ffi-objc-arc-02-strong-property: assigns child to parent's strong
     property, releases the original child reference. Midpoint check:
     child's dealloc should NOT have fired (strong setter retained).
     Pre-M4.B-setter: child dealloc fires immediately → "FAIL: child
     dealloc'd at midpoint" snapshot. Exit code 1.
   - ffi-objc-arc-03-weak-property: assigns target to holder's weak
     property, releases target. Reads holder.target → should be null
     (auto-niled). Pre-M4.B-getter/setter: reads stale pointer →
     "FAIL: weak property didn't auto-nil" snapshot.

These will turn green as M4.B setter (commit 2), getter (commit 3),
and dealloc-cleanup (commit 4) land. Each subsequent commit updates
the snapshot to reflect the now-passing output.

189/189 example tests pass; chess on iOS-sim green.

examples/ffi-objc-arc-02-strong-property.sx

@@ -0,0 +1,78 @@
+// ffi-objc-arc-02 — #property(strong) on sx-defined class.
+//
+// Strong contract:
+//   - setter retains the new value, releases the old.
+//   - -dealloc releases each strong property ivar before freeing state.
+//
+// Observation: a child instance assigned to a parent's strong property
+// stays alive after we drop our own reference. Without the strong
+// setter, the child's refcount drops to 0 immediately when we release,
+// and the parent ends up with a dangling pointer.
+//
+// We observe via TrackingAllocator. The KEY check is the dealloc count
+// AT THE MIDPOINT — between dropping our child reference and releasing
+// the parent. With strong+dealloc-cleanup: child stays alive across
+// midpoint (no extra dealloc). Without: child is dead at midpoint.
+
+#import "modules/std.sx";
+#import "modules/allocators.sx";
+#import "modules/std/objc.sx";
+#import "modules/compiler.sx";
+
+SxStrongChild :: #objc_class("SxStrongChild") {
+    #extends NSObject;
+    tag: s32;
+    alloc :: () -> *SxStrongChild;
+}
+
+SxStrongParent :: #objc_class("SxStrongParent") {
+    #extends NSObject;
+    child: *SxStrongChild #property(strong);
+    alloc :: () -> *SxStrongParent;
+}
+
+main :: () -> s32 {
+    inline if OS == .macos {
+        gpa := GPA.init();
+        tracker := TrackingAllocator.init(xx gpa);
+
+        push Context.{ allocator = xx tracker, data = null } {
+            d0 := tracker.dealloc_count;
+            a0 := tracker.alloc_count;
+
+            parent := SxStrongParent.alloc();
+            child  := SxStrongChild.alloc();
+            parent.child = child;   // dispatches setChild: via M2.2 property machinery
+            child.release();
+
+            // Midpoint: with strong setter, child is retained by parent;
+            // tracker.dealloc_count should NOT have advanced beyond d0.
+            // Without strong setter, child auto-dealloc'd on release.
+            d_mid := tracker.dealloc_count;
+            if d_mid != d0 {
+                print("FAIL: child dealloc'd at midpoint (strong setter not retaining); delta={}\n",
+                      d_mid - d0);
+                return 1;
+            }
+
+            parent.release();
+
+            // After parent.release: parent.dealloc fires, releases the
+            // strong child ivar, child deallocs, state freed.
+            d_end := tracker.dealloc_count;
+            // Net: 2 allocs (parent + child state), 2 deallocs (both freed).
+            // Balance check: dealloc delta == alloc delta.
+            if d_end - d0 != tracker.alloc_count - a0 {
+                print("FAIL: unbalanced; alloc={} dealloc={}\n",
+                      tracker.alloc_count - a0, d_end - d0);
+                return 1;
+            }
+        }
+
+        print("strong property: ok\n");
+    }
+    inline if OS != .macos {
+        print("skipped (not macos)\n");
+    }
+    0;
+}

examples/ffi-objc-arc-03-weak-property.sx

@@ -0,0 +1,66 @@
+// ffi-objc-arc-03 — #property(weak) on sx-defined class.
+//
+// Weak contract:
+//   - setter calls objc_storeWeak — does NOT retain.
+//   - getter calls objc_loadWeakRetained + autorelease — auto-nils
+//     if the target has been deallocated.
+//   - -dealloc calls objc_destroyWeak on each weak ivar.
+//
+// Observation: assign a target to the weak property. Drop the
+// caller's strong reference. Read back via the weak getter — should
+// be `null` (the target deallocated when its last strong ref
+// dropped, and the weak slot auto-niled).
+//
+// Pre-M4.B: setter just stores the pointer (no storeWeak); getter
+// reads the raw pointer (no loadWeakRetained). After target's
+// release, the slot points at freed memory — the read returns the
+// stale pointer (not null). The test catches this by comparing the
+// read result to null.
+
+#import "modules/std.sx";
+#import "modules/allocators.sx";
+#import "modules/std/objc.sx";
+#import "modules/compiler.sx";
+
+SxWeakTarget :: #objc_class("SxWeakTarget") {
+    #extends NSObject;
+    tag: s32;
+    alloc :: () -> *SxWeakTarget;
+}
+
+SxWeakHolder :: #objc_class("SxWeakHolder") {
+    #extends NSObject;
+    target: *SxWeakTarget #property(weak);
+    alloc :: () -> *SxWeakHolder;
+}
+
+main :: () -> s32 {
+    inline if OS == .macos {
+        gpa := GPA.init();
+        tracker := TrackingAllocator.init(xx gpa);
+
+        push Context.{ allocator = xx tracker, data = null } {
+            holder := SxWeakHolder.alloc();
+            target := SxWeakTarget.alloc();
+            holder.target = target;
+            target.release();
+
+            // After release: target's refcount → 0 → target deallocates.
+            // With weak: holder.target should read as null (auto-niled).
+            // Without weak: holder.target reads as the stale pointer.
+            read_back := holder.target;
+            if read_back != null {
+                print("FAIL: weak property didn't auto-nil after target dealloc\n");
+                return 1;
+            }
+
+            holder.release();
+        }
+
+        print("weak property: ok\n");
+    }
+    inline if OS != .macos {
+        print("skipped (not macos)\n");
+    }
+    0;
+}